Privacy notice

1. Who is responsible for your data

SMART SSO, S.A. de C.V. ("SmartAlly", "we"), located at Calle Calendula 19, Col. San Lorenzo Atemoaya, Xochimilco, C.P. 16400, Ciudad de México, México, is the controller of the personal data described in this notice, under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties and its regulations.

For any privacy matter, including your rights, write to us at connect@smartally.io. Our privacy team handles requests and maintains this notice.

2. When we are the controller and when we are a processor

Our role depends on who you are and how your data reaches SmartAlly:

• Controller: when you visit smartally.io, write to us through a form, book a call, create an account or use the platform as a customer or as a member of a business's team. We decide why and how that data is used, and this notice covers it.
• Processor: when a business uses SmartAlly to serve its own customers over WhatsApp, Instagram, Messenger, web chat or scheduling. That business is the controller of the data. We only process it on the business's behalf, following its instructions and our Data processing agreement.

If you are a customer of a business that uses SmartAlly and want to know what it does with your data or exercise your rights, check that business's privacy notice and contact it directly. If you write to us, we pass your request on and help the business answer you.

3. What data we process and where it comes from

We do not ask you for sensitive personal data or for financial data beyond what we need to bill you. The data of our customers' customers, such as messages that arrive on connected channels, is covered in the previous section and in the section on channel data and AI.

4. What we use your data for

Purposes needed to provide the service:

• Answering your requests and giving you information you ask for about SmartAlly.
• Creating and running your account, signing you in and giving your team access.
• Providing the service: the assistant, the conversation inbox, scheduling, reminders and payments.
• Billing, invoicing and keeping our accounts.
• Sending service emails, such as confirmations, account notices, service changes and security alerts.
• Providing support, finding bugs and keeping the platform secure, including protection against fraud, abuse and bots.
• Meeting legal obligations and responding to requests from authorities.

Secondary purposes, which are not needed for the service: understanding how the site is used, measuring which ads work, sending you SmartAlly news and content, and inviting you to surveys or events.

You can opt out of secondary purposes anytime without affecting your service. For analytics and ad measurement, use the cookie notice or "Cookie preferences" in the footer. For news, use the unsubscribe link in each email or the switch in your profile. You can also write to connect@smartally.io.

5. Cookies, measurement and ads

We use essential cookies to make the site work, plus analytics cookies (Google Analytics and Microsoft Clarity) and marketing cookies (Meta Pixel) that you can reject from the cookie notice or in Cookie preferences. Where the law requires prior acceptance, such as in the European Union, United Kingdom, Switzerland, Brazil or Quebec, we do not use them until you accept. Your choice applies on smartally.io and app.smartally.io, and you can change it anytime.

If you accept marketing, besides loading the Pixel, when you submit a form we notify Meta through its Conversions API. That notice includes your email turned into an irreversible code (SHA-256 hash), your IP, your browser and Meta's browser IDs, and tells us which ads bring in contacts.

If you do not accept marketing, we do not load the Pixel or send anything to Meta. Your request is handled the same way. The details of each cookie are in the cookie policy.

6. Connected channel data and artificial intelligence

When a business connects WhatsApp, Instagram, Messenger, its email or Google Calendar, SmartAlly receives only what the feature it turned on needs: messages and contact details from conversations, basic information about the connected page or account, and calendar events.

• We use that data only to provide the service to the business that connected it: receiving and answering messages, showing conversations in its inbox and booking appointments.
• We do not sell it, use it for advertising or combine it with other data to build profiles outside the service.
• To generate replies, the assistant sends the conversation content and the business's information to artificial intelligence providers. Those providers act on our behalf and may not use that data for their own purposes.
• We do not train general-purpose artificial intelligence models with the data of businesses or their customers. We give each business's assistant knowledge from that business's own information, such as services, prices, hours and frequent answers, and only that business uses it.
• The business can disconnect each channel anytime from the platform. Once it does, we stop receiving new data from that channel.

SmartAlly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

A message may contain sensitive data, for example health data if the business is a clinic. The business is responsible for obtaining the consent the law requires for that data, and we protect it with the same security measures and use it only to provide the service.

7. Who we share your data with

We share data with providers that help us deliver the service. They process it on our behalf, under contract and only for that purpose, so your consent is not required:

• Cloud hosting and storage.
• Messaging, to deliver messages on the channels a business connects.
• Artificial intelligence, to generate the assistant's replies.
• Payments, for charges and invoicing.
• Email, to send service emails and answer requests.
• Scheduling, to book calls and appointments.
• Security, to protect forms against bots.

We do not sell your personal data. The names of our providers, what we use them for and their country are listed on the providers page.

8. Transfers outside Mexico

Several of our providers are in other countries, mainly the United States, so your data may be processed outside Mexico. We require them by contract to protect it to a standard equivalent to this notice and to use it only for what we ask.

9. How long we keep your data

When these periods end we delete or anonymize the data. If we must keep it for a legal obligation or to defend a right, we block it and use it only for that.

10. How we protect your data

We have administrative, technical and physical measures to protect your data against damage, loss, alteration and unauthorized access or use. These include encryption in transit, role-based access control, authentication for staff, backups and provider reviews.

If a security breach significantly affects your rights, we notify you without delay so you can take action.

11. Your ARCO rights and how to exercise them

You can access your data, rectify it if it is wrong, cancel it when it is no longer needed or object to its use for certain purposes. You can also withdraw your consent or limit the use and disclosure of your data.

To do so, write to connect@smartally.io with:

• Your name and an email or address where we can reply.
• An official ID or, if someone acts for you, their ID and proof of representation.
• Which right you want to exercise and over which data.
• For a rectification, the correct data and, if applicable, a supporting document.

We reply within 20 business days of receiving your complete request. If it applies, we carry it out within the following 15 business days. We deliver the information by email in a common format, free of charge, except for any shipping or copy costs the law allows.

Withdrawing your consent may prevent us from continuing a service that depends on that data. We will tell you before applying it.

If you are not satisfied with our answer, you can go to the Mexican personal data protection authority, currently the Ministry of Anti-Corruption and Good Governance.

12. If you are outside Mexico

SmartAlly serves businesses in several countries. In addition to this notice, the following applies depending on where you are:

• European Union, European Economic Area, United Kingdom and Switzerland: we process your data to perform our contract with you, to meet legal obligations, for our legitimate interest in handling your requests and protecting the service, or with your consent for analytics and marketing. You can access your data, rectify it, ask us to erase it, restrict its use, object, ask for a copy to take to another service and withdraw your consent. You can also file a complaint with the data protection authority in your country. When your data leaves your region, we use the European Commission's standard contractual clauses or an equivalent mechanism.
• United States: we do not sell your data. Some state laws, such as California's, treat the Meta Pixel as "sharing" data for advertising. You can opt out by turning marketing off in Cookie preferences. If your browser sends the Global Privacy Control signal, we treat it as turning marketing off. You can also ask to access, correct or delete your data, and we will not treat you differently for exercising these rights.
• Brazil: you have the rights under the LGPD. You can confirm whether we process your data, access it, correct it, anonymize it, take it to another service, delete it and withdraw your consent. You can also go to the ANPD.
• Canada: you can access your data, correct it and withdraw your consent. In Quebec we do not turn on analytics or marketing until you accept them.
• Any other country: we respect the rights the law where you live gives you.

To exercise any of these rights, write to connect@smartally.io. We reply within the time the law that applies to you sets.

13. Minors

SmartAlly is a service for businesses and is not meant for people under 18. If we learn that we received data from a minor without a parent or guardian's authorization, we delete it.

14. Changes to this notice

If we change this notice, we post the new version on this page with its update date. If the change is significant, we also let you know by email or in the platform before it takes effect.